From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mailman by lists.gnu.org with tmda-scanned (Exim 4.43) id 1Nnal9-00062V-4G for qemu-devel@nongnu.org; Fri, 05 Mar 2010 11:52:19 -0500 Received: from [199.232.76.173] (port=56006 helo=monty-python.gnu.org) by lists.gnu.org with esmtp (Exim 4.43) id 1Nnal8-00062B-7S for qemu-devel@nongnu.org; Fri, 05 Mar 2010 11:52:18 -0500 Received: from Debian-exim by monty-python.gnu.org with spam-scanned (Exim 4.60) (envelope-from ) id 1Nnal6-0001Fb-Ei for qemu-devel@nongnu.org; Fri, 05 Mar 2010 11:52:17 -0500 Received: from alpha.arachsys.com ([91.203.57.7]:41887) by monty-python.gnu.org with esmtps (TLS-1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.60) (envelope-from ) id 1Nnal6-0001FL-2q for qemu-devel@nongnu.org; Fri, 05 Mar 2010 11:52:16 -0500 Date: Fri, 5 Mar 2010 16:52:09 +0000 From: Chris Webb Message-ID: <20100305165209.GL29711@arachsys.com> References: <20100221172358.GH4894@arachsys.com> <4B82462A.7050903@redhat.com> <4B82F8ED.6000303@codemonkey.ws> <20100301181416.GB15908@arachsys.com> <4B8E70DB.4080108@codemonkey.ws> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <4B8E70DB.4080108@codemonkey.ws> Subject: [Qemu-devel] Re: Another VNC crash, qemu-kvm-0.12.3 List-Id: qemu-devel.nongnu.org List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Anthony Liguori Cc: qemu-devel@nongnu.org, kvm@vger.kernel.org Anthony Liguori writes: > On 03/01/2010 12:14 PM, Chris Webb wrote: > >We've just seen another VNC related qemu-kvm crash, this time an arithmetic > >exception at vnc.c:1424 in the newly release qemu-kvm 0.12.3. > > > > [...] > > 1423 if (vs->absolute) { > > 1424 kbd_mouse_event(x * 0x7FFF / (ds_get_width(vs->ds) - 1), > > 1425 y * 0x7FFF / (ds_get_height(vs->ds) - 1), > > 1426 dz, buttons); > > 1427 } else if (vnc_has_feature(vs, VNC_FEATURE_POINTER_TYPE_CHANGE)) { > > 1428 x -= 0x7FFF; > > [...] > > > >and sure enough: > > > > (gdb) p vs->ds->surface->width > > $1 = 9 > > (gdb) p vs->ds->surface->height > > $2 = 1 > > > >What a 9x1 display surface is doing on this guest is a mystery to me, but you > >definitely can't divide by one less than its height! > > Can you reproduce this reliably? If so, what's the procedure? No, I'm afraid not, although I have had a thorough play myself with a variety of VNC clients in an attempt to reproduce. The background here is that we're running a public hosting service where customers can install and run their own OSes on their own qemu-kvm virtual machines. I don't even know what VNC client (if any) was connected at the time. I only see the core dump if the qemu-kvm crashes. Of course, if the screen width or height is 1, it doesn't really matter what the value of the mouse position for the click is, so something as simple as diff --git a/vnc.c b/vnc.c --- a/vnc.c +++ b/vnc.c @@ -1421,8 +1421,10 @@ dz = 1; if (vs->absolute) { - kbd_mouse_event(x * 0x7FFF / (ds_get_width(vs->ds) - 1), - y * 0x7FFF / (ds_get_height(vs->ds) - 1), + kbd_mouse_event(ds_get_width(vs->ds) > 1 ? + x * 0x7FFF / (ds_get_width(vs->ds) - 1) : 0x4000, + ds_get_height(vs->ds) > 1 ? + y * 0x7FFF / (ds_get_height(vs->ds) - 1) : 0x4000, dz, buttons); } else if (vnc_has_feature(vs, VNC_FEATURE_POINTER_TYPE_CHANGE)) { x -= 0x7FFF; will fix the symptom: the division by zero. The underlying cause of a 9x1 display surface is a bit mysterious though. Cheers, Chris.